{
	"id": "62631167-7ecf-4d87-960c-940c14861139",
	"created_at": "2026-04-06T00:13:09.706908Z",
	"updated_at": "2026-04-10T03:21:11.925381Z",
	"deleted_at": null,
	"sha1_hash": "587cee00733ce252ac869492160b55f4be0654dc",
	"title": "Hive Ransomware: Actively Targeting Hospitals",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 143213,
	"plain_text": "Hive Ransomware: Actively Targeting Hospitals\r\nBy Gustavo Palazolo\r\nPublished: 2021-09-10 · Archived: 2026-04-05 22:34:32 UTC\r\nSummary\r\nMost ransomware groups operating in the RaaS (Ransomware-as-a-Service) model have an internal code of ethics\r\nthat includes avoiding breaching some specific sectors, such as hospitals or critical infrastructure, thus avoiding\r\ngreat harm to society and consequently drawing less attention from law enforcement. For example, the\r\nBlackMatter ransomware states they are not willing to attack hospitals, critical infrastructure, defense industry,\r\nnon-profit companies, and oil and gas industry targets, having learned from the mistakes of other groups, such as\r\nDarkSide, who shut down its operations after the Colonial Pipeline attack.\r\nHowever, this code of ethics is not always adopted by attackers, as is the case with Hive, a new family of\r\nransomware discovered in June 2021. On August 15, 2021, Hive ransomware was responsible for an attack against\r\nthe Memorial Health System, a non-profit integrated health system with three hospitals in Ohio and West Virginia\r\n(Marietta Memorial Hospital, Selby General Hospital, and Sistersville General Hospital), causing radiology exams\r\nand surgical cases to be canceled. According to the FBI, the group uses phishing emails with malicious\r\nattachments to gain access into networks, allowing the attackers to move laterally over the network to steal data\r\nand infect more machines.\r\nHiveLeaks\r\nIn addition to encrypting files, Hive also steals sensitive data from networks, threatening to publish everything in\r\ntheir HiveLeak website, hosted on the deep web, which is a common practice among ransomware working in this\r\ndouble extortion scheme.\r\nThere are two websites maintained by the group, the first one is protected by username and password, accessible\r\nonly by the victims who obtain the credentials in the ransom note.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 1 of 30\n\nFigure 01. Hive ransomware private website\r\nOnce authenticated, the victim can see:\r\n1. The name of the infected organization;\r\n2. A live chat, where the victim can interact with the attackers;\r\n3. A file upload system, where the victim can send files to the attackers;\r\n4. A link to Hive’s decryption software, if the ransom is paid by the victims.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 2 of 30\n\nFigure 02. Victim’s private website by Hive ransomware\r\nThe second website, “HiveLeaks,” is where the attackers publish data about their targets and is publicly\r\naccessible.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 3 of 30\n\nFigure 03. “HiveLeaks” logo.\r\nFor each target, you can see the name, a small description, the website, the revenue, and the number of employees\r\nat the company. Also, you can see two dates, when the files were encrypted and when the attack was made public.\r\nCuriously enough, there are also two social media buttons where you can share this information.\r\nFigure 04. Information about the infected company on the “HiveLeaks” website.\r\nIf any data is published by the attackers, you will also find a link where the files can be downloaded. Hive uses\r\ncommon file-sharing services for this purpose, such as PrivatLab, AnonFiles, MEGA, UFile, SendSpace, and\r\nExploit.in, as shown in Figure 05.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 4 of 30\n\nFigure 05. Links to download stolen data by Hive.\r\nMemorial Health System Attack\r\nThe Hive ransomware infected the Memorial Health System (MHS) on August 15, 2021. The attackers claim to\r\nhave stolen patient data including names, social security numbers, dates of birth, addresses and phone numbers,\r\nand medical histories for 200,000 patients, and an additional 1.2 TB of other data.\r\nMHS tried to appeal to the attackers to provide the decrypter for free but ultimately ended up paying 1.8M,\r\ndivided equally into two Bitcoin wallets. The attackers moved the Bitcoins to another wallet just a few minutes\r\nafter the transaction was made by MHS.\r\nAside from the decryptor, the attackers also promise a security report, a file tree describing all stolen data, and the\r\nlogs proving that they had erased everything from their servers.\r\nAnalysis\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 5 of 30\n\nThe ransomware was written in Go, an open-source programming language that allows cross-compilation,\r\nmeaning that the same source code can be compiled to different OS, such as Linux, Windows, and macOS.\r\nAlthough we have only seen Windows versions in the wild at this point, we have strong indications that the group\r\nis able to infect other systems such as Linux, as well as the Hypervisor ESXi, as we will demonstrate later in the\r\nanalysis.\r\nWe have analyzed two different samples, being 32 and 64-bit Windows versions of the malware. Both of them are\r\npacked with UPX, which is an open-source executable packer.\r\nFigure 06. Main Hive ransomware payload, packed with UPX.\r\nThe first thing we noticed is that both samples we analyzed had a command line interface (CLI), accepting\r\nparameters and also showing log messages throughout the malware execution.\r\nThe 64-bit sample accepts two parameters:\r\nkill: Kill processes specified as value (case insensitive regex)\r\nstop: Stop services specified as value (case insensitive regex)\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 6 of 30\n\nFigure 07. Parameters accepted by the 64-bit sample of Hive.\r\nOn the other hand, the 32-bit sample offers three more options:\r\nkill: Kill processes specified as value (case insensitive regex)\r\nno-clean: Do not clean disk space (described later in this analysis)\r\nskip: Files that the attacker doesn’t want to encrypt (case insensitive regex)\r\nskip-before: Skips files created before the specified date.\r\nstop: Stop services specified as value (case insensitive regex)\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 7 of 30\n\nFigure 08. Parameters accepted by the 32-bit sample of Hive.\r\nAside from the parameters above, the attacker can also specify the path containing the files that need to be\r\nencrypted. If this path isn’t specified, the ransomware will list all the files in the machine, skipping the ones\r\nspecified in the “-skip” and “-skip-before” parameters.\r\nFor analysis purposes, we have created a folder named “C:\\to_encrypt”, containing three different pictures. Once\r\nexecuted, the ransomware starts printing out log messages throughout the whole encryption process.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 8 of 30\n\nFigure 09. 32-bit Hive ransomware execution.\r\nThe log messages show pretty much everything the malware is doing, however, let’s take a look at each one of the\r\naspects being printed out.\r\nAnalyzing this 32-bit sample closely, we can see some of the function names parsed by the disassembler, from a\r\npackage the attackers named as “google.com”, perhaps as an attempt to deceive the analyst.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 9 of 30\n\nFigure 10. 32-bit Hive function names.\r\nFirst, the malware calls a function encryptor.NewApp().\r\nFigure 11. “NewApp” Hive function.\r\nSimply put, this function initializes some important data used by the ransomware, such as the primary key.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 10 of 30\n\nFigure 12. “NewApp” function flow.\r\nThe function keys.NewPrimaryKey() generates a 10 MB random key used in the encryption process.\r\nFigure 13. 10 MB key generated by Hive.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 11 of 30\n\nOnce the key is generated, the ransom note and a batch script are loaded into memory, which will be eventually\r\nsaved to the disk during the process.\r\nAfter this setup is completed, the ransomware calls a function named App.Run(), which starts the flow we saw in\r\nthe log messages.\r\nFigure 14. Hive “Run” function.\r\nThe first function called inside App.Run() is App.ExportKey().\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 12 of 30\n\nFigure 15. “ExportKey” function.\r\nThis function is responsible for encrypting the 10 MB key generated by keys.NewPrimaryKey().\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 13 of 30\n\nFigure 16. Main flow of “ExportKey” function.\r\nHive contains 100 public RSA keys embedded in the binary, which are used to encrypt the key generated\r\npreviously. They are all parsed through the function ParsePKCS1PublicKey from the pkcs1.go library.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 14 of 30\n\nFigure 17. Hive ransomware loading public RSA keys.\r\nThe malware then encrypts the data using the EncryptOAEP function from the rsa.go library.\r\nFigure 18. Hive encrypting the key using RSA.\r\nThe encrypted key is then saved into a file that ends with “.key.hive” extension (or “key.\u003crandom\u003e” for the 64-bit\r\nversion). This is the file that is eventually loaded by the decryptor to retrieve the encryption key used in the\r\nprocess.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 15 of 30\n\nFigure 19. Key file saved by Hive during the process.\r\nAfter creating the encrypted key, the malware calls two functions named App.KillProcesses() and\r\nApp.StopServices().\r\nFigure 20. Hive functions to kill processes and stop services.\r\nThe name of these functions are self-explanatory, and the full list of default values for stopped processes and\r\nservices can be found in our GitHub repository.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 16 of 30\n\nNext, Hive executes the functions App.RemoveItself() and App.RemoveShadowCopies().\r\nFigure 21. Next two functions executed by the “Run”.\r\nThe first one is responsible for creating a batch script that was loaded into memory by the function\r\nencryptor.NewApp(). The purpose of this script is to delete the ransomware payload once this process is done.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 17 of 30\n\nFigure 22. Batch script created by Hive to delete the payload from disk\r\nThe second function creates another batch script in disk that is responsible for deleting Windows Shadow Copies,\r\nto prevent any file restoration.\r\nFigure 23. “shadow.bat” script created by the 32-bit Hive.\r\nHere, we have a big difference between the two samples we have analyzed. Instead of creating a batch script, the\r\n64-bit version we found uses several commands to delete not only the Windows Shadow Copies, but also to stop\r\nservices, including Windows Defender.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 18 of 30\n\nFigure 24. Commands executed by the 64-bit Hive sample we analyzed.\r\nThe full list of commands executed by the 64-bit version can be found in our GitHub repository.\r\nNext in the flow, we have two important functions:\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 19 of 30\n\nFigure 30. “ScanFiles” and “EncryptFiles” functions of Hive.\r\nApp.ScanFiles() is responsible for fetching all the files that will be encrypted by the ransomware. Also, this\r\nfunction creates the ransom note in disk, which was already loaded in memory previously.\r\nApp.EncryptFiles() does exactly what the name describes. Within that function, the code is calling another two,\r\nrespectively encryptFilesGroup() and EncryptFile(), loading the contents of the targeted file in memory,\r\nencrypting the data with what seems to be a custom algorithm created by Hive developers. Then, the encrypted\r\nfile is written into disk, using the extension “.hive”.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 20 of 30\n\nFigure 26. Files encrypted by Hive ransomware.\r\nFollowing the file encryption, we have another two functions executed by App.Run().\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 21 of 30\n\nFigure 27. “EraseKey” and “Notify” functions.\r\nThe function App.EraseKey() accesses the memory location where the 10 MB primary key was stored by Hive\r\nand replaces all its bytes with random data.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 22 of 30\n\nFigure 28. Before and after the “EraseKey” function\r\nApp.Notify() creates the ransom note in disk, which is redundant since this file is also created by the function\r\nApp.ScanFiles().\r\nLast but not least, we have a curious function executed by the ransomware if the flag “-no-clean” wasn’t\r\nspecified, named App.CleanSpace().\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 23 of 30\n\nFigure 29. “CleanSpace” function.\r\nSimply put, if executed, this code creates several files with 1GB+ each until the disk is full. Then, these newly\r\ncreated files are deleted.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 24 of 30\n\nFigure 30. Files created by the “CleanSpace” function.\r\nSince Hive deletes files that have been encrypted, this process is likely performed to overwrite any bytes on disk\r\nthat could potentially be restored to their original state, creating new files to replace deleted ones.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 25 of 30\n\nFigure 31. Disk space while the “CleanSpace” function is being executed.\r\nDifferent from other ransomware families, Hive doesn’t change the user background, the only message available\r\nto the victim is the ransom note.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 26 of 30\n\nFigure 32. Hive ransom note.\r\nAccording to the note, if the user deletes the file that has the “.key” extension, the data will be undecryptable,\r\nwhich leads us to the next part of this blog.\r\nDecryptor\r\nHive provides decryptors for ESXi, Linux, and Windows (32 / 64-bit).\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 27 of 30\n\nFigure 33. Hive ransomware decryptors for MHS.\r\nAlthough we only found Windows versions of Hive in the wild, this is a strong indication that they have payloads\r\nfor other systems, aligning with the fact that the whole code was built in Go language, which is multi-platform.\r\nWhen it comes to the decryption process, the file first loads the encrypted key from disk, which is why the ransom\r\nnote states that you can’t delete this file.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 28 of 30\n\nFigure 34. Hive decryption process\r\nOnce the key is loaded and decrypted, Hive scans all directories searching for encrypted files, and then proceeds\r\nwith the decryption process.\r\nConclusion\r\nHive is yet another ransomware group that is likely operating in the RaaS model. However, the process used to\r\nencrypt the files is quite unusual. \r\nUsually, the encryption process implemented by ransomware in the wild is to generate a unique symmetric key for\r\neach file, that is eventually encrypted and stored along with the encrypted data, so it can be recovered later.\r\nInstead, Hive creates a unique key that is eventually encrypted and written into disk, making the decryption\r\nprocess irreversible if this file is deleted by accident. Furthermore, this ransomware contains functionalities that\r\nmake the execution slow, such as “wiping” the disk until it’s full to avoid file restoration.\r\nRegardless of these points, we consider Hive a dangerous threat, as it’s already causing damage to people and\r\norganizations, combined with the fact that the threat is multi-platform.\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 29 of 30\n\nProtection\r\nNetskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat\r\nindicators and payloads. \r\nNetskope Threat Protection\r\nGen:Variant.Ransom.Hive.2\r\nTrojan.GenericKD.37237769\r\nNetskope Advanced Threat Protection provides proactive coverage against this threat.\r\nGen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis\r\nGen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox\r\nIOCs\r\nSHA256\r\nhive_x86 1e21c8e27a97de1796ca47a9613477cf7aec335a783469c5ca3a09d4f07db0ff\r\nhive_x64 321d0c4f1bbb44c53cd02186107a18b7a44c840a9a5f0a78bdac06868136b72c\r\nA full list of IOCs is available in our Git repo.\r\nSource: https://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nhttps://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals\r\nPage 30 of 30\n\n https://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals  \nFigure 15. “ExportKey” function.  \nThis function is responsible for encrypting the 10 MB key generated by keys.NewPrimaryKey().\n  Page 13 of 30",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals"
	],
	"report_names": [
		"hive-ransomware-actively-targeting-hospitals"
	],
	"threat_actors": [],
	"ts_created_at": 1775434389,
	"ts_updated_at": 1775791271,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/587cee00733ce252ac869492160b55f4be0654dc.pdf",
		"text": "https://archive.orkl.eu/587cee00733ce252ac869492160b55f4be0654dc.txt",
		"img": "https://archive.orkl.eu/587cee00733ce252ac869492160b55f4be0654dc.jpg"
	}
}